FlatRatePay Payment Gateway For WooCommerce WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

1.2.1

Findings

1

Worst severity

medium

Content hash

08934a410fc9192554fdd734… Copy

Findings

• medium field_name() override posts full PAN and CVC to WordPress despite client-side tokenization

  insecure_config

  The gateway advertises client-side tokenization (changelog 1.1: 'No more SAQ D'; README: PCI-DSS SAQ A-EP) and supports['tokenization']. WooCommerce's WC_Payment_Gateway_CC::field_name() returns an empty string in that case so the card-number/expiry/cvc inputs have ids but no name attributes and are omitted from the checkout POST. This plugin overrides field_name() to always emit name="givepay_gateway-{field}", while the copied docblock still says 'we don't want the data to post to the server'. form() then calls parent::form(), so process-checkout includes givepay_gateway-card-number (full PAN) and givepay_gateway-card-cvc. get_card_from_request() never reads the PAN field — it uses the JS-injected givepay_gateway-gpg-token and givepay_gateway-card-number-last4 — so the PAN is unused by PHP but still present in $_POST, PHP error/access logs, WAFs that log bodies, and any other plugin that dumps the request. CVC is also posted (needed for Card::withToken on the server); PAN posting is not. Tokenization JS may fail silently (deferred reject with no checkout notice) and the named PAN field still submits. Last upstream tag is v1.2.1 (2019-08-09); there is no Update URI.

  FlatRatePay/FlatRatePayWooCommerceGateway.php:328-340

  Recommendation

  Remove the field_name() override (or return '' for card-number) so the PAN input has no name attribute and never appears in $_POST. Keep a named CVC field only if the processor requires CVC with the token, and never log $_POST or the CVC. Clear named card-number values in JS after tokenization. Rotate any logs that may have captured PANs. Upstream has not shipped a tag since 2019; prefer a maintained gateway if a patch cannot be applied.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.